Trading Standards 2017/18 City of York Council Internal Audit Report

Business Unit: Economy and Place Directorate Responsible Officer: Assistant Director Planning and Public Protection Service Managers: Acting Head of Public Protection Head of Regional Investigations Date Issued: 6th July 2018 Status: Final Reference: 10750/001

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction The main purpose of the trading standards team is to maintain a fair and safe trading environment for consumers and businesses in York. The trading standards team uses a variety of interventions such as inspections and test purchasing to ensure regulations are being met by local businesses and investigates instances of malpractice and non compliance. York is also the lead organiser for the Yorkshire & Humberside Trading Standards Group which investigates trading scams that operate across council boundaries in Yorkshire and Humberside. Both the local and regional teams are based at the Hazel Court depot.

During 2016/17 there were eight successful prosecutions of York businesses along with fourteen successful prosecutions undertaken by the regional team. The punishments handed out include fines, short prison sentences, temporary closures and cautions.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that:

- Businesses are selected for intervention based on an intelligence based scoring system.
- Businesses are being correctly charged when consultancy work is being provided by the Trading Standards team.
- The governance arrangements for the National Trading Standards Regional Investigations and eCrime teams ensure that regional and national work can be carried out effectively.

Key Findings There is a control strategy, which is in effect a business plan, is in place to ensure trading standards work is targeted appropriately in York to ensure that key council objectives were being achieved. This strategy was devised following an annual conference for senior staff in the Public Protection team where key priorities were identified based on statistics on York’s economy, population and crime and other key criteria. Strategies were set down at all levels of the council’s team structures and were being followed consistently. However, during 2017/18 the Public Protection Team was not updating their strategy document during the year to monitor the progress being made to achieve key objectives.

Consultancy work was being undertaken appropriately with good records being kept of the work that was done and agreed with the client. The charging rates were correctly calculated and were based on hourly staff costs and a proportion of overhead costs. The only concern was that knowledge of the case often depended on the person who had undertaken the work being able to deal with queries.

The arrangements for Regional investigations and eCrime work were found to be working well. Regional Investigations and eCrime work are grant funded with regular reports being made to the National Trading Standards Board to update them of progress being made. No serious issues were noted except that the Memorandum of Understanding between the council and North Yorkshire County Council which covers eCrime work was now out of date. Overall Conclusions The arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance.

1. The Memorandum of Understanding that covers eCrime work is out of date

| Issue/Control Weakness | Risk | |----------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The Memorandum of Understanding between the council and North Yorkshire County Council that covers eCrime work is out of date. | A dispute occurs between the council and North Yorkshire County Council that can't be resolved because the Memorandum of Understanding is out of date. |

**Findings**

The Memorandum of Understanding for eCrime work between the council and North Yorkshire County Council is dated 1st April 2012 to 31st March 2015 and has not been updated or renewed.

The financial arrangements set down in the Memorandum did not set down what would happen if costs relating to eCrime work were not covered by a grant because the Memorandum simply stated that eligible costs would be 100% funded.

**Agreed Action 1.1**

A temporary Memorandum of Understanding will be put in place by 31st July. A permanent one will be completed once changes to the division of Proceeds of Crime Act incentivisation arrangements have been completed. This will need to be included in a new Memorandum of Understanding with North Yorkshire County Council and will need member approval.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-------------------------| | 2 | Head of Regional Investigations | 31st December 2018 |

## 2. Updating the Public Protection Control Strategy document

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The Public Protection Control Strategy document was not being updated during 2017/18. | The objectives that were agreed in the Public Protection Strategy document are not being monitored and achieved. |

### Findings

The Public Protection Control Strategy document set down the priorities for the year for the Public Protection Team. This document, however, was not updated throughout 2017/18 to show the progress being made to achieve the objectives that were agreed at the outset.

It was also noted that Public Protection Team Management team meetings had not taken place between May and December 2017 where progress against the Strategy document would be discussed.

### Agreed Action 2.1

Public Protection Control strategy is part of Public Protection Managers Meeting agenda, and regular meeting dates have been put into diaries.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------------| | 3 | Acting Head of Public Protection | 30th June 2018 |

### 3. Defining work that should be charged to the client

| Issue/Control Weakness | Risk | |------------------------|------| | The guidance sheet available to officers does not define what work is chargeable and that which is offered free of charge. | The council does not charge for work that should be classed as chargeable consultancy work. |

#### Findings

A guidance sheet describes how consultancy costs are charged and how staff can avoid conflicts of interest. However, the guidance sheet doesn't set down whether work should be chargeable. During the audit, the Acting Head of Public Protection stated that the team worked on the principle that ad hoc advice given over the phone or in person at Hazel Court was free but that meetings or visits that needed to be organised and involve staff time are chargeable. However, this procedure is not formalised.

#### Agreed Action 3.1

A new practice note (written procedure) on charging for services to be introduced. This will include when to charge, how much to charge and where to record and store work.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Acting Head of Public Protection | 30th June 2018 |

### 4. Records of consultancy work

| Issue/Control Weakness | Risk | |------------------------|------| | There was no standard filing system for records kept of consultancy work that has been done. | Key documents that relate to consultancy work cannot be found in case they are needed in future. |

#### Findings

Records were being kept of the agreed scope of consultancy work, working papers done during the work and the report issued to the client. However, the records were not kept in a standard filing system which meant that reliance was placed on the member of staff who did the work to obtain key documents.

#### Agreed Action 4.1

A new practice note (written procedure) on charging for services to be introduced. This will include how records relating to consultancy work should be kept and filed.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Acting Head of Public Protection. | 30th June 2018 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.